The Shape of Code

The use of software in high value transactions has created an interesting new field of software research that investigates the leakage of information from programs. The kind of information leaked, so-called sideband information, can take various forms, including:

• The amount of time taken to perform some operation. Many developers instinctively do their best to ensure that code does not take any longer to execute than it has to. In the case of one commonly used authentication system, the time taken to fail to authenticate an encryption key provided useful information on how close one trial encryption-key was compared to another (the closer the trial key to the actual key, the longer the authentication took to fail). The obvious implementation technique to foil this kind of attack is to add random delays into the authentication process.

  It has even proved possible to perform timing attacks against a remote machine over the Internet to remote

• Use of some part of the value of secure information, by a system library function, to create the value passed back to the caller, e.g.,

  if (secret_value & 0xf000) // Tell the caller that the top 'secret' four bits are set return 1; else return 0;

  if (secret_value & 0xf000) // Tell the caller that the top 'secret' four bits are set return 1; else return 0;

  Researchers have been able to analyse the information flow of input values through some very large C programs.

• Analyse of network traffic routing information to work out who is talking to who. Various kinds of anonymizers have been created in attempt to make various forms of Internet traffic untraceable.

Any Internet program is accessible to information flow analysis. Using these techniques to analyse the search algorithm used by Google might be overly ambitious. A Google algorithm that might be within reach of is the one used by Adwords; the behavior of this algorithm is of interest to a growing number of people.

Information leakage techniques are becoming more widely known and developers working on programs containing a security component now need to consider how they can prevent information being leaked to attackers who sample program behavior looking for exploitable weaknesses.